CVE-2026-94243

HighCVSS 7.3/10Last modified Oct 6, 2026

Description

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.

This issue affects Apache Sling Security Bundle: before 1.3.2.

Users are recommended to upgrade to version 1.3.2, which fixes the issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Oct 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-942444.3The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticaCVE-2026-942456.5The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet CVE-2026-942466.3The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission beCVE-2026-94258.8A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The impacted element is the function formWlanMP of the file /goform/foCVE-2026-942508.2Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller cCVE-2026-942516.5A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue afCVE-2026-942545.3The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, aCVE-2026-942568.1The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs CVE-2026-942578.1The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actuallyCVE-2026-942582.7The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before retCVE-2026-94268.8A vulnerability was detected in Edimax EW-7438RPn 1.31. This affects the function formHwSet of the file /goform/formHwSet. The manipulation CVE-2026-942605.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a
CVE-2026-94243: High severity, CVSS 7.3 | Vulnix